What potential security vulnerabilities are present in the provided PHP code, especially in relation to SQL injection?

The provided PHP code is vulnerable to SQL injection due to directly concatenating user input into the SQL query without sanitization. To mitigate this vulnerability, you should use prepared statements with parameterized queries to prevent malicious SQL injection attacks. 

// Original vulnerable code
$username = $_POST['username'];
$password = $_POST['password'];

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);

// Fixed code using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();

Keywords

SQL injection PHP code security vulnerabilities data sanitization prepared statements

Related Questions